diff --git a/sys/dev/usb/net/if_ure.c b/sys/dev/usb/net/if_ure.c
--- a/sys/dev/usb/net/if_ure.c
+++ b/sys/dev/usb/net/if_ure.c
@@ -24,6 +24,8 @@
  * SUCH DAMAGE.
  */
 
+#include "opt_inet6.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/bus.h>
@@ -44,6 +46,10 @@
 /* needed for checksum offload */
 #include <netinet/in.h>
 #include <netinet/ip.h>
+#ifdef INET6
+#include <netinet/ip6.h>
+#include <netinet6/ip6_var.h>
+#endif
 
 #include <dev/mii/mii.h>
 #include <dev/mii/miivar.h>
@@ -62,8 +68,6 @@
 
 #include "miibus_if.h"
 
-#include "opt_inet6.h"
-
 #ifdef USB_DEBUG
 static int ure_debug = 0;
 
@@ -2179,7 +2183,6 @@
 	struct ip ip;
 	struct ether_header *eh;
 	int flags;
-	uint32_t data;
 	uint32_t reg;
 	int l3off, l4off;
 	uint16_t type;
@@ -2214,10 +2217,9 @@
 	if (flags & CSUM_IP)
 		reg |= URE_TXPKT_IPV4_CS;
 
-	data = m->m_pkthdr.csum_data;
 	if (flags & (CSUM_IP_TCP | CSUM_IP_UDP)) {
 		m_copydata(m, l3off, sizeof ip, (caddr_t)&ip);
-		l4off = l3off + (ip.ip_hl << 2) + data;
+		l4off = l3off + (ip.ip_hl << 2);
 		if (__predict_false(l4off > URE_L4_OFFSET_MAX))
 			return (1);
 
@@ -2230,7 +2232,9 @@
 	}
 #ifdef INET6
 	else if (flags & (CSUM_IP6_TCP | CSUM_IP6_UDP)) {
-		l4off = l3off + data;
+		l4off = ip6_lasthdr(m, l3off, IPPROTO_IPV6, NULL);
+		if (__predict_false(l4off < 0))
+			return (1);
 		if (__predict_false(l4off > URE_L4_OFFSET_MAX))
 			return (1);